# Disallow PHP in certain directories?

**URL:** <https://forum.kirupa.com/t/disallow-php-in-certain-directories/35311>\
**Category:** programming\
**Created:** [November 12, 2003, 4:58pm UTC](https://forum.kirupa.com/t/disallow-php-in-certain-directories/35311 "2003-11-12T16:58:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![corvettekenny](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@corvettekenny](https://forum.kirupa.com/u/corvettekenny)\
**Post date:** [November 12, 2003, 4:58pm UTC](https://forum.kirupa.com/t/disallow-php-in-certain-directories/35311/1 "2003-11-12T16:58:57Z")

</div>

I’ve been working on setting up a web server to host pages for friends, and hopefully a few businesses eventually. I’ve been using PHP for a while, and I have a web-based front end for people to upload files and such which relies on the filesystem commands (fopen, readfile, etc.)… I don’t want any user on my webserver having access to the filesystem commands, for the obvious reasons… I can disable the file commands using the php.ini file, but then my front end would no longer work. The best solution I can come up with is running two seperate servers: one with full php commands enabled which runs the front end, and one with limited php enabled which serves up the user directories.

There has to be a simpler solution… Is there any way I can specify a limited set of php commands for the user folders? Or, can I totally disable PHP commands for the user folders?

And a side note, I’m running something called sambar server ([www.sambar.com](http://www.sambar.com)) … I’m hesitant to switch to IIS , because I’m not too good at keeping up on hotfixes, but if I do, will that offer me a solution to this prob?

Thanks a lot! :azn: Kenny

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/kirupa/original/3X/6/2/621e5c11736f46532526e61be85940af4230f3e5.png) [@system](https://forum.kirupa.com/u/system)\
**Post date:** [November 13, 2003, 2:39am UTC](https://forum.kirupa.com/t/disallow-php-in-certain-directories/35311/2 "2003-11-13T02:39:57Z")

</div>

You should run PHP in safe mode and setup your scripts such that they don’t require system commands.

There are plenty of way to do upload/file management that would work in PHP safe mode and would keep your system secure from harmful system commands.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/kirupa/original/3X/6/2/621e5c11736f46532526e61be85940af4230f3e5.png) [@system](https://forum.kirupa.com/u/system)\
**Post date:** [November 14, 2003, 9:09pm UTC](https://forum.kirupa.com/t/disallow-php-in-certain-directories/35311/3 "2003-11-14T21:09:36Z")

</div>

> \*Originally posted by corvettekenny \*  
> There has to be a simpler solution… Is there any way I can specify a limited set of php commands for the user folders? Or, can I totally disable PHP commands for the user folders? \*\*

I’m not familiar with Sambar, but on Apache you can disable script-associatons on a per-directory basis using .htaccess. So if all else fails… 🙂

Useful reading for Apache:

[RemoveType](http://httpd.apache.org/docs/mod/mod_mime.html#removetype)

[AddType](http://httpd.apache.org/docs/mod/mod_mime.html#addtype)

[.htaccess](http://httpd.apache.org/docs-2.1/en/howto/htaccess.html)

Hope it’s of some use.